2017-07-31 22:07:30 +02:00
|
|
|
MAILTO="{{ ssl_support_email }}"
|
|
|
|
|
|
|
|
|
|
# The goal of this cronjob is to ask acmetool to check
|
|
|
|
|
# the current SSL certificates and to see if some need renewal.
|
2017-08-06 18:10:50 +02:00
|
|
|
# If so, it would attempt to renew.
|
2017-07-31 22:07:30 +02:00
|
|
|
#
|
|
|
|
|
# Various services depend on these certificates and would need to be restarted.
|
|
|
|
|
# This is not our concern here. We simply make sure the certificates are up to date.
|
|
|
|
|
# Restarting of services happens on its own different schedule (other cronjobs).
|
|
|
|
|
#
|
2017-08-06 18:10:50 +02:00
|
|
|
#
|
|
|
|
|
# How renewal works?
|
|
|
|
|
#
|
|
|
|
|
# acmetool will fail to bind to port :80 (because matrix-nginx-proxy is running there),
|
|
|
|
|
# and will fall back to its "webroot" validation method.
|
|
|
|
|
#
|
|
|
|
|
# Thus, it would put validation files in `/var/run/acme/acme-challenge`.
|
|
|
|
|
# These files can be retrieved via any vhost on port 80 of matrix-nginx-proxy,
|
|
|
|
|
# because it aliases `/.well-known/acme-challenge` to that same directory.
|
2017-07-31 22:07:30 +02:00
|
|
|
|
2017-08-06 18:10:50 +02:00
|
|
|
15 4 */5 * * root /usr/bin/docker run --rm --name acmetool-host-grab --net=host -v {{ ssl_certs_path }}:/certs -v {{ ssl_certs_path }}/run:/var/run/acme -e ACME_EMAIL={{ ssl_support_email }} willwill/acme-docker acmetool --batch reconcile # --xlog.severity=debug
|
